53

I've found that some .gov sites are being redirected to a Chinese IP. I have searched across Internet to see if this a known form of malware but I'm unable to find any info. I would like someone guiding me to isolate the infected files and report to AV if applicable.

This is a nslookup resolution from the infected computer:

C:\Users\Alex>nslookup www.whitehouse.gov
Servidor:  google-public-dns-a.google.com
Address:  8.8.8.8

Respuesta no autoritativa:
Nombre:  www.whitehouse.gov
Address:  139.129.57.70

This is a valid response from a Linux computer in the same network:

alex@nas:~$ nslookup www.whitehouse.gov
Server:         8.8.8.8
Address:        8.8.8.8#53

Non-authoritative answer:
www.whitehouse.gov      canonical name = wildcard.whitehouse.gov.edgekey.net.
wildcard.whitehouse.gov.edgekey.net     canonical name = e4036.dscb.akamaiedge.net.
Name:   e4036.dscb.akamaiedge.net
Address: 104.83.16.193

As you can see something is intervening the DNS requests and redirecting to 139.129.57.70, that is a Chinese IP. I think this computer is infected by some kind of malware made to impersonate as gov sites and leak info.

Any clue about which files may be infected?

Improve this question
12
  • 5
    may you share tracert 8.8.8.8 result of both linux and windows machine? Also, if you nslookup with another dns server other than Google, is it same?
    – JackSparrow
    Nov 21, 2017 at 13:55
  • 10
    Content Delivery Networks. Look them up. :)
    – Mark Buffalo
    Nov 21, 2017 at 14:46
  • 16
    @SmokeDispenser Technically, it is security-related, given the political implications of why this might exist in the first place. :P
    – Mark Buffalo
    Nov 21, 2017 at 17:43
  • 4
    Does Mueller know about this?
    – user114541
    Nov 21, 2017 at 22:34
  • 9
    @SmokeDispenser The question is whether the OP is experiencing DNS spoofing or not, which seems decidedly security-related to me. That that answer happens to be "No, instead your router was configured incorrectly" doesn't make the question itself not security-related. Also, even if this question were deemed off-topic here, voting to migrate to SuperUser would seem to make more sense than voting to close.
    – reirab
    Nov 22, 2017 at 8:21

3 Answers 3

Reset to default
74

Content Delivery Network

This is probably part of a Content Delivery Network with a lot of political issues to consider.

If you try dig www.whitehouse.gov a, underneath the answer section you'll see the following:

www.whitehouse.gov. 131 IN  CNAME   wildcard.whitehouse.gov.edgekey.net.
wildcard.whitehouse.gov.edgekey.net. 731 IN CNAME e4036.dscb.akamaiedge.net.
e4036.dscb.akamaiedge.net. 20   IN  A   23.73.28.110

See the CNAME addresses? Try host -t A www.whitehouse.gov for a better explanation:

www.whitehouse.gov is an alias for wildcard.whitehouse.gov.edgekey.net.
wildcard.whitehouse.gov.edgekey.net is an alias for e4036.dscb.akamaiedge.net.
e4036.dscb.akamaiedge.net has address 23.73.28.110

Do you notice that I'm getting a different IP address than you? Note the wildcard*edge* portion? What is that? It's an edge server which is supposed to be closest to you.

Are you using a VPN on your Linux machine, or Windows Machine? Maybe one that's in Hong Kong, Hangzhou, or somewhere else in East Asia? Maybe your router is configured to use a VPN, or go through TOR?

The IP address you received belongs to Aliyun Computing Co. Ltd, which is part of the Alibaba Cloud/CDN suite.

But wait, how did we we get an Aliyun Cloud/CDN (Alibaba) IP address from Akamai? Aren't they competitors?

Again, are you using a VPN on your Linux machine, or Windows Machine? Maybe one that's in Hong Kong, Hangzhou, or somewhere else in East Asia? Maybe your router is configured to use a VPN, or go through TOR?

Akamai does operate in China, but...

Want to make money in China? You have to follow Beijing's rules. I think we just found something embarrassing for Akamai: in order to operate in China, they were likely forced into a partnership with them.

To do business in China, almost all foreign companies were previously required to hand over control of their intellectual property to a joint Chinese partner to be allowed to operate in the country.

Let's look at the IP you gave us: whois 139.129.57.70 | grep -i 'Ali\|Hangzhou':

netname:        ALISOFT
descr:          Aliyun Computing Co., LTD
descr:          No.391 Wen'er Road, Hangzhou, Zhejiang, China, 310099
address:        NO.969 West Wen Yi Road, Yu Hang District, Hangzhou
e-mail:         jiali.jl@alibaba-inc.com
address:        No.391 Wen'er Road, Hangzhou City
e-mail:         anti-spam@list.alibaba-inc.com
e-mail:         cloud-cc-sqcloud@list.alibaba-inc.com
address:        Hangzhou, Zhejiang, China
address:        No.391 Wen'er Road, Hangzhou City
e-mail:         guowei.pangw@alibaba-inc.com

In this case, the Akamai partner is likely Alibaba/Aliyun. This allows the Chinese government, if they so desire, to serve malicious content to visitors by way of the CDN.

Every single CDN is, in my opinion, MITM as a service.

Wireshark? You might be doing it wrong.

What if you did have a DNS hijacking/MITM issue of some sort? If you want to use Wireshark, you probably cannot do a packet capture between your router and computer unless the problem exists primarily on your Windows 10 machine. You'd simply be receiving whatever your router provides you with.

If there is no problem with your Windows 10 machine, then using Wireshark on your computer will likely not provide you any meaningful information. What if your router has been compromised?

What you could do is put a switch with port mirroring capabilities between your gateway and your router, and use the port mirror to see what's going on. Or a LAN throwing star. This way, you can see what your router is sending and receiving, and compare that to what Wireshark sees.

Improve this answer
16
  • 14
    Well, I'm on Spain, getting the chinese IP as the resolution was what put me in alert status about something was going on. You are right with wireshark. In case of a serius infection that wouldn't have been the right place to see the raw packets. But at least this time it has helped me to see that my computer was asking for www.whitehouse.gov.casa instead of www.whitehouse.gov, then I realised my DNS suffix in my router's DHCPd is .casa (I know now that is not a good practise to put arbitrary names in lan dns suffix).
    – Alex
    Nov 21, 2017 at 17:03
  • 6
    Slightly less plausible, but also that IP blocks are bought and sold regularly and whois may not be up to date.
    – Steve
    Nov 21, 2017 at 18:03
  • 9
    @Alex This is interesting to me. Did you purchase the router with the .casa settings? gov.casa, interestingly enough, belongs to a State-Owned Enterprise in China, Alibaba. I would love to investigate this issue if you could provide us with a make/model of the router.
    – Mark Buffalo
    Nov 21, 2017 at 20:28
  • 4
    @Mark: No, "casa" means "home/house" in spanish. I manually configured that dns suffix long ago for my home lan and never had problems with it until some days ago. Btw my router is a linksys e4200 with a custom firmware that I installed (Tomato RAF) that I've been using for at least 2 years without changing its config.
    – Alex
    Nov 21, 2017 at 20:51
  • 14
    "MITM as a service" LOL! This sounds almost as useful as /dev/null as a service.
    – reirab
    Nov 22, 2017 at 8:28
35

Well, I've installed Wireshark and applied a DNS filter to see what was happening. When I do the nslookup from Windows to whitehouse.gov I can see in Wireshark that it is appending (without showing it to me) my home DNS suffix (.casa).

Then I tried from the Linux machine to resolve anything.gov.casa and it resolved to the said Chinese IP.

So I'm pretty sure the problem here is that Windows is shadowly appending my home DNS suffix (.casa) to gov domains. Why it has starting doing this I don't know, this suffix is configured in my tomato RAF router since a lot of years, and this behaviour has starting happening in the last days. Some days ago I entered without problem in jpl.nasa.gov to see some pictures, so this change is very recent.

Maybe the problem is in the .casa TLD that may have gone public in the last days, or some change in a Windows 10 recent update, but definitely not a security related problem.

Thanks all for the advice.

Improve this answer
8
  • How did you stumble upon the change? Why do you conclude that it has been recent from you being able to visit a valid .gov website? It could come from a reverse proxy and be delivered to you nonetheless there seems to be a DNS mismatch.
    – Tobi Nary
    Nov 21, 2017 at 16:40
  • 2
    Casa is a valid TLD, by the way, since 2014. So this is solely a networking problem
    – Tobi Nary
    Nov 21, 2017 at 17:17
  • 2
    Yes, and in fact gov.casa isn't new. It was registered in nov 2016. What I dont know if the owner recently added a dns wildcard or thats just a Windows change that made this behaviour to happen now.
    – Alex
    Nov 21, 2017 at 17:34
  • 23
    Don't invent new fake TLDs. .lan is reserved for this purpose; use it.
    – R.. GitHub STOP HELPING ICE
    Nov 22, 2017 at 5:36
  • 4
    Wildcarding - I bet this wasn't ever a problem in the past, and your router/PC was simply wasting a DNS lookup every time searching for whatever.casa which didn't exist. But now it does. This has caught out my fortune 50 employer too. One solution is to buy your own domain name and use it internally, avoiding anyone else gaining control of it.
    – Criggie
    Nov 22, 2017 at 20:44
2

First I would have a look at the C:\Windows\System32\drivers\etc\hosts file, if you find listings for some .gov domains (or others, by default its empty) that should not be listed here.. Then thats why the DNS did not proper work.

From the file itself:

This file contains the mappings of IP addresses to host names

But I also advise you, as Luc said, to reinstall the computer, if there is a virus editing the hosts file (which is only able with admin rights) it could do much worse stuff.

Improve this answer
3
  • 1
    Yes, I checked hosts file before posting. The file has not been modified. In fact, something I've realised is that if I try nslookup with a non existent gov domain (ie. www.dasdasdsadsa.gov) it also resolves to 139.129.57.70
    – Alex
    Nov 21, 2017 at 13:45
  • Oh, and also something I've seen is that the resolution takes like 1-2 seconds, it is not immediate, that make me suspect that is not coming from local.
    – Alex
    Nov 21, 2017 at 13:49
  • 1
    There is something very wrong with your computer if (the somewhat misnamed) nslookup is returning entries from your hosts file.
    – symcbean
    Nov 21, 2017 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .